firebase-iid-interop-17.1.0.aar: 1 vulnerabilities (highest severity is: 6.1)

[mend-bolt-for-github]

Vulnerable Library - firebase-iid-interop-17.1.0.aar

Path to dependency file: /feature/course-view/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.android.gms/play-services-basement/18.0.0/1e804f5288f6cd645a872b17556f8f375bcbc274/play-services-basement-18.0.0.aar

Found in HEAD commit: 77a89ac5bd1696a91ab9e7654223c13959e4b2c1

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (firebase-iid-interop version)	Remediation Possible**
CVE-2022-2390	Medium	6.1	play-services-basement-18.0.0.aar	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-2390

Vulnerable Library - play-services-basement-18.0.0.aar

Path to dependency file: /feature/push/build.gradle.kts

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.android.gms/play-services-basement/18.0.0/1e804f5288f6cd645a872b17556f8f375bcbc274/play-services-basement-18.0.0.aar

Dependency Hierarchy:

• firebase-iid-interop-17.1.0.aar (Root Library)
  • ❌ play-services-basement-18.0.0.aar (Vulnerable Library)

Found in HEAD commit: 77a89ac5bd1696a91ab9e7654223c13959e4b2c1

Found in base branch: develop

Vulnerability Details

Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.

Publish Date: 2022-08-12

URL: CVE-2022-2390

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cm6r-892j-jv2g

Release Date: 2022-08-12

Fix Resolution: com.google.android.gms:play-services-basement:18.0.2

Step up your Open Source Security Game with Mend here